WebLogic Server 8.1 API Reference

weblogic.security.providers.authentication
Class DefaultUserNameMapperImpl

java.lang.Object
  |
  +--weblogic.security.providers.authentication.DefaultUserNameMapperImpl

public class DefaultUserNameMapperImpl

extends java.lang.Object

implements UserNameMapper

Implementation of the UserNameMapper interface used to perform certificate-based and distinguished name user authentication via configuration attributes. Certificate-based authentication can be performed when a remote client makes a two-way-authenticated secure connection to the server, in which case the client's certificate chain can be used to authenticate the remote user. This removes the need for the client to explicitly provide a username and password. Distinguished name authentication can be performed via CSIv2 identity assertion.

To use this implementation in the Default Identity Asserter, use the Administration Console to display the DefaultIdentityAsserter Details tab and set the Use Default User Name Mapper check box to on. Then (also on the Details tab) to configure which attributes in the distinguished name are to be used to map to the username, set the Default User Name Mapper Attribute Type: and Default User Name Mapper Attribute Delimiter: fields to the desired values. For example, if you want to use the name in the Email address in the subject distinguished name to map to the username, select the values E and @. For an Email value of smith@bea.com, smith would be mapped to the username.

Author:

Copyright © 2004 BEA Systems, Inc. All Rights Reserved.

Constructor Summary

DefaultUserNameMapperImpl(java.lang.String subjectDNAttribute, java.lang.String attributeDelimiter)
Creates the DefaultUserNameMapper implementation.

Method Summary

java.lang.String	mapCertificateToUserName(java.security.cert.X509Certificate[] certs, boolean ssl) Maps a certificate to a username based on a certificate chain presented.
java.lang.String	mapDistinguishedNameToUserName(byte[] distinguishedName) Map a X.501 distinguished name to a username based on the distinguished name attributes and values.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultUserNameMapperImpl

public DefaultUserNameMapperImpl(java.lang.String subjectDNAttribute,
                                 java.lang.String attributeDelimiter)

Creates the DefaultUserNameMapper implementation.

Parameters:

subjectDNAttribute - The attribute in the subject DN (distinguished name) from the certificate that should be used in the mapping from certificate to username. This should be a value such as "ST", "E", or "CN".

attributeDelimiter - The delimiter to use as the end of the username in the mapping. For example, "@" in the value "E=smith@bea.com".

Method Detail

mapCertificateToUserName

public java.lang.String mapCertificateToUserName(java.security.cert.X509Certificate[] certs,
                                                 boolean ssl)

Maps a certificate to a username based on a certificate chain presented. If the user can be mapped successfully, this method returns the user with its WebLogic username optionally derived from the certificate, otherwise it returns null.

Specified by:

mapCertificateToUserName in interface UserNameMapper

Parameters:

certs - certificate chain presented by the client. An array of length at least 1. The first certificate is the leaf (i.e. end user's) certificate. If the length is greater than 1, the array is a certificate chain, with the last element being the root CA.

ssl - true if the certificates to check were presented by the client during a successful two-way SSL handshake.

Returns:

user name derived from certificate, if mapping succeeded, or null if failed

mapDistinguishedNameToUserName

public java.lang.String mapDistinguishedNameToUserName(byte[] distinguishedName)

Map a X.501 distinguished name to a username based on the distinguished name attributes and values. If the user can be mapped successfully, this method returns the user with its WebLogic username optionally derived from the distinguished name, otherwise it returns null.

Specified by:

mapDistinguishedNameToUserName in interface UserNameMapper

Parameters:

distinguishedName - ASN.1 encoding of a X.501 distinguished name.

Returns:

user name derived from distinguished name, if mapping succeeded, or null if failed